{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:a82456cc-43a0-5bd4-ad8c-d5a4c8521c2a",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "activemq-openwire-generator",
      "purl": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.8-tuxcare.2",
      "type": "library",
      "group": "org.apache.activemq",
      "bom-ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.8-tuxcare.2",
      "version": "6.1.8-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "activemq-openwire-generator",
            "purl": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.8",
            "type": "library",
            "group": "org.apache.activemq",
            "version": "6.1.8"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2017-15709",
      "affects": [
        {
          "ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.8-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:94355485-db3c-5cab-8fc3-96216a115a14",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2017-15709 does not affect version 6.1.8-tuxcare.2 of org.apache.activemq:activemq-openwire-generator. not_affected \u2014 CVE-2017-15709: The target ActiveMQ 6.1.8 is NOT AFFECTED. The vulnerability (system information disclosure via OpenWire protocol) was fixed in upstream commit 5fa0bbd51 (AMQ-6871) by Christopher L. Shannon, which was already included in the ActiveMQ 6.1.8 release that TuxCare onboarded. The fix changes the default behavior to send generic platform details (\"Java\") instead of detailed OS/kernel...",
        "justification": "code_not_present"
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.apache.activemq/activemq-openwire-generator@6.1.8-tuxcare.2"
    }
  ]
}